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Top Stories 

• The U.S. Department of State announced rewards totaling $3 million March 26 for 
information leading to the arrest of 2 Russian nationals believed to be key members in the 
Carder.su financial and identity fraud scheme that has caused losses of at least $50 million. 
- Securityweek (See item 6) 

• Interstate 35 in Salado, Texas, reopened March 27 after it was closed for nearly 18 hours 
when a semi-truck crashed into a highway bridge and two beams fell onto the interstate 
hitting several vehicles March 26. - KWTX 10 Waco (See item 8) 

• Authorities are investigating after 34 cars of a Union Pacific train derailed along the 
Nevada Subdivision in Lovelock March 25, prompting the delay of 33 trains that were 
rerouted around the scene. - Reno Gazette- Journal (See item 12 ) 

• An apparent gas explosion March 26 destroyed 4 New York City apartment buildings, 
displacing residents from about 49 units, and injuring 19 individuals while 2 others were 
reportedly missing. - Reuters (See item 25 ) 
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Energy Sector 



1. March 27, Bristol Herald Courier - (Virginia) Prosecutor says pair’s kickback 
schemes were an abuse of trust. Prosecutors announced March 26 that 2 former 
Bristol Virginia Utilities Authority vice presidents pleaded guilty to charges in 
connection to receiving kickbacks by approving falsified invoices in order to help an 
unidentified company fraudulently bill the utility nearly $500,000 between 2006 and 
2013. The former employees accepted kickbacks in the form of cash or through 
personal companies which amounted to tens of thousands of dollars. 

Source: http://www.tricities.com/news/prosecutor-savs-pair-s-kickback-schemes-were- 
an-abuse-of/article ec3fd7 fc-d3cc- 1 1 e4-b 1 7 4-b7 6163102991 .html 



For another story, see item 21 
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Chemical Industry Sector 

2. March 27, KNTV 11 San Jose - (California) Health advisory lifted after "release" at 
Dow Chemical plant in Pittsburg. Contra Costa County issued a Level 2 health 
advisory March 27 for Pittsburg and Antioch after an estimated several thousand 
pounds of chemicals were released into the air due to a machinery malfunction at the 
Dow Chemical facility in Pittsburg. No injuries were reported and the advisory was 
lifted almost 3 hours later. 

Source: http://www.nbcbavarea.com/news/local/Health-Advisory-Lifted-After-Release- 
at-Dow-Chemical-Plant-in-Pittsburg-297779241.html 

For another story, see item 13 
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Nuclear Reactors, Materials, and Waste Sector 

3. March 27, Reuters - (New Mexico) Wrong kitty litter led to radiation leak at New 
Mexico nuke waste dump. A U.S. Department of Energy report released March 26 
identified an chemical reaction in the barrel of a drum of waste that was improperly 
packaged at the Los Alamos National Laboratory as the cause of a February 2014 
radiation leak at the Waste Isolation Pilot Plant near Carlsbad, New Mexico, that 
exposed 22 workers to radiation and closed the plant indefinitely. The use of the wrong 
type of kitty litter used to absorb radioactive material was also included in the improper 
mix in the barrel, contributing to the chemical reaction. 

Source: http://www.reuters.com/article/2015/03/27/us-usa-nuclear-new-mexico- 
idUSKBN0MN0C9201 50327 

4. March 26, Huntsville Times - (Alabama) Browns Ferry worker injured, exposed to 
radiation in Wednesday fall. A Browns Ferry nuclear plant worker suffered minor 
injuries and slight radiation exposure March 25 after falling 5 feet while conducting an 
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inspection of the dry well of the Athens-based plant’s Unit 2 reactor as part of a 
planned refueling outage. The Tennessee Valley Authority reported that the employee 
was successfully decontaminated and that there were no radiological safety 
consequences related to the mishap. 

Source: 

http://www.al.com/news/huntsville/index.ssf/2015/03/browns ferry worker injured e 
x.html#incart river 
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Critical Manufacturing Sector 

5. March 24, U.S. Department of Labor - (Alabama) US Steel Corp.’s safety shortcuts 
lead to fatal explosion. The Occupational Safety and Health Administration issued 
U.S. Steel Corp., 1 willful citation for failing to develop and use a procedure to control 
hazardous energy to allow workers to operate furnace valves while they are in 
operation, and 7 other serious citations as a result of an investigation into the cause of a 
September 2014 explosion that killed 2 workers and seriously burned another at its 
Fairfield, Alabama facility. Proposed fines for the citations totaled $107,900. 

Source: https://www.osha.gov/newsrelease/reg4-20150324.html 

For another story, see item 21 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 

6. March 27, Securityweek - (International) U.S. offers $3 million reward for alleged 
Russian cybercriminals. The U.S. Department of State announced rewards totaling $3 
million March 26 for information leading to the arrest or conviction of 2 Russian 
nationals believed to be key members in the Carder.su operation, in which participants 
created and trafficked identification documents and payment cards and perpetrated 
financial fraud and identity theft, causing losses of at least $50 million. Thirty members 
involved in the operation have been convicted and 25 remaining are fugitives or 
pending trial. 

Source: http://www.securitvweek.com/us-offers-3-million-reward-alleged-russian- 
cybercriminals 

7. March 26, Associated Press - (New York) FINRA fines Oppenheimer $3.75M in 
employee fraud case. The Financial Industry Regulatory Authority issued a $3.75 
million fine to Oppenheimer & Co., for failing to supervise and stop an employee from 
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transferring $2.9 million of client funds to his own accounts or for use in excessive 
trades while he was under investigation for other fraud accusations, including a 2012 
scheme in which he allegedly scammed a New York City Broadway show’s producers 
out of $20,000 after promising to raise $4.5 million from phony investors. 

Source: http://www.newsobserver.com/entertainment/celebrities/articlel6389836.html 

For another story, see item 23 
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Transportation Systems Sector 

8. March 27, KWTX 10 Waco - (Texas) 1-35 reopens after fiery 18-wheeler crash kills 
1, injures 3. Interstate 35 at Farm-to-market Road 2484 in Salado reopened in both 
directions March 27 after it was closed for nearly 1 8 hours when an oversized semi- 
truck crashed into a highway bridge and dislodged two beams that fell onto the 
interstate hitting several vehicles March 26. One individual was killed and 3 others 
were injured during the incident that remains under investigation. 

Source: http://www.kwtx.com/home/headlines/Maior-Crash-On-Interstate-35-Shuts- 
Down-Highway-297669591.html 

9. March 26, Associated Press - (South Dakota) County officials reopen state Highway 
11 near Corson. State Highway 1 1 from Interstate 90 to north of Corson was closed 
for several hours March 26 because the roadway was blocked by fire trucks and 
personnel that were battling a blaze at the site of a former grain elevator that started as 
a controlled burn and spread to an adjacent structure. 

Source: http://www.mitchellrepublic.com/news/state/3708825-county-officials-reopen- 
state-highway- 1 1 -near-corson 

10. March 26, Associated Press - (Vermont) Plane makes emergency landing in 
Burlington. A US Airways jet flying from Philadelphia to Montreal diverted to 
Burlington International Airport in Vermont to make an unscheduled landing due to a 
cracked windshield that developed midair and required inspection. The approximately 
50 passengers onboard the flight were transferred to a bus that continued on to 
Montreal. 

Source: http://www.buiiingtonfreepress.com/storv/news/local/2015/03/26/plane-makes- 
emer gene y-landin g-burlin gton/705 05 8 1 2/ 

11. March 26, Columbus Dispatch - (Ohio) 1-71 open again after tanker-truck leak 
fouls rush hour. All lanes of Interstate 71 south of Route 161 in Columbus, Ohio, were 
closed for about 3 hours March 26 while authorities inspected a semi-truck hauling 
sodium hydroxide after police spotted a leak from the vehicle’s outer shell. An 
inspection by the Ohio Environmental Protection Agency revealed that the leak was 
water and found that a release valve needed to be repaired. 

Source: http://www.dispatch.com/content/stories/local/2015/03/26/i71-closed.html 

12. March 26, Reno Gazette -Journal - (Nevada) Derailed Nevada train delays 33 others. 
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Authorities are investigating after 34 cars of a 51 -car Union Pacific train derailed along 
the Nevada Subdivision in Lovelock March 25. The derailment delayed 30 freight 
trains and 3 Amtrak trains that were rerouted around the scene where wreckage was 
strewn for hundreds of yards. 

Source: http://www.rgi.com/storv/news/2015/03/26/derailed-car-train-delays-trains- 
churchill-co/7 0492756/ 
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Food and Agriculture Sector 

13. March 26, Associated Press - (Idaho) Agency: Monsanto to pay $600K in fines for 
not reporting chemical releases at Idaho plant. Monsanto Co., entered into an 
agreement March 26 with the U.S. Environmental Protection Agency and the U.S. 
Department of Justice and agreed to pay $600,000 in penalties to resolve charges that 
the company failed to report hundreds of uncontrolled releases of toxic chemicals at its 
Soda Springs facilities between 2006 and 2009. 

Source: 

http://www.tribtown.com/view/story/b96261abeb57432d9ebf95692e78ab77/ID— 

Monsanto-Chemical-Releases 

14. March 26, WCJB 20 Gainesville - (Florida) Farm fire kills 24,000 chicks. A large 
chicken coop at Saavedra Farm in Suwannee County was destroyed and about 24,000 
baby chicks perished in a March 25 fire that was sparked by a fan that malfunctioned. 
Source: http://www.wcib.com/local-news/2015/03/farm-fire-kills-24000-chicks 
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Water and Wastewater Systems Sector 

15. March 26, Detroit News - (Michigan) Plymouth ends boil- water alert. The city of 
Plymouth lifted a boil water alert March 27 that affected 9,100 residents and was issued 
March 26 following a series of water main breaks that caused the city’s water system to 
lose pressure. The system was flushed and bacteriological testing showed that the water 
met or exceeded standards for drinking before the advisory was lifted. 

Source: http://www.detroitnews.com/storv/news/local/wayne-countv/2015/03/26/boil- 
water-alert-issued-plymouth/70475900/ 

For another story, see item 21 
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Healthcare and Public Health Sector 

16. March 27, RARE 11 Minneapolis - (Minnesota) 1 dead in Woodbury senior living 
fire. A March 27 fire at the Woodbury Senior Fiving apartments in Minnesota left 1 
person dead and at least 2 others hospitalized while 71 residents were evacuated for 
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nearly 4 hours. Officials worked to move 9-10 residents to other portions of the 
Woodbury Health Care Center after the fire caused extensive smoke and water damage 
to their apartments. 

Source: http://www.karell.com/story/news/2015/03/27/l-dead-in-woodbury-senior- 
living-fire/70532132/ 

For another story, see item 21 



T Return to top i 



Government Facilities Sector 

17. March 27, WMUR 9 Manchester - (New Hampshire) Amherst Middle School 
students dismissed over bomb threat. Officials dismissed Amherst Middle School 
students March 27 while police searched the New Hampshire school after a 
handwritten note was found claiming there was a bomb in the bathroom of the building. 
Source: http://www.wmur.com/news/amherst-middle-school-students-dismissed-over- 
bomb-threat/32046780 

18. March 26, Reuters - (Illinois) Two U.S. men arrested in plot to attack Illinois 
military base: Justice Department. The U.S. Department of Justice announced March 
26 that a Chicago-area U.S. Army National Guard soldier and his cousin were arrested 
and charged for conspiring to support Islamic State (ISIS) in a plot which included an 
attack on an Illinois National Guard facility. Both men had met with an undercover FBI 
agent and discussed plans to attack the facility where the U.S. Army National Guard 
specialist was training. 

Source: http://www.msn.com/en-us/news/us/two-us-men-arrested-in-plot-to-attack- 
ilhnois-militarv-base-iustice-department/ar-AAa3au4 

19. March 26, KJRH 2 Tulsa - (Oklahoma) Tulsa Public Schools reopening Friday; 
power restored to Jones Elementary. Officials with Tulsa Public Schools announced 
that classes will resume March 27 following the cancelation of classes March 26 due to 
severe storms that passed through Oklahoma March 25 and knocked out power to 
several area schools. 

Source: http://www.kjrh.com/news/local-news/tulsa-public-schools-reopening-friday- 
with-possible-exception-of-jones-elementary 

For additional stories, see items 21 and 27 
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Emergency Services Sector 

Nothing to report 
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Information Technology Sector 



20. March 27, Softpedia - (International) GitHub has been under a continuous DDoS 
attack in the last 24 hours. The GitHub Web site suffered a minor service outage 
March 26 and has been mitigating a sustained distributed denial-of-service (DDoS) 
attack on its servers that has lasted over 24 hours. Administrators reported that that 
connectivity resumed to normal after the attack was amplified March 27, and are 
continuing to monitor for any abnormalities. 

Source: http://news.softpedia.com/news/GitHub-Has-Been-Under-a-Continuous-DDoS- 
Attack-in-the-Last-24-Hours-47 6902 . shtml 



21. March 26, Threatpost - (International) GE fixes buffer overflow bug in DTM 
library. General Electric released a patch for a vulnerability in device type 
management (DTM) libraries affecting five Highway Addressable Remote Transducer 
(HART) digital communication devices deployed in various critical infrastructure 
areas, including one manufactured by MACTek. The vulnerability allows an attacker to 
execute arbitrary code by causing a buffer overflow in the product’s DTM and crashing 
the Field Device Tool (FDT) Frame Application. 

Source: https://threatpost.eom/ge-fixes-buffer-overfIow-bug-in-dtm-librarv/l 11817 

22. March 27, CSO Online - (International) DDOS attacks less frequent last year, more 
dangerous. San Francisco-based Black Fotus Communications released a report which 
found that the total number of distributed denial-of-service (DDoS) attacks declined 
steadily in 2014, but increased in packet size by 3.4 times in the third quarter, and 
average attack size by 12.1 gigabits per second (Gbps) in the fourth quarter. The report 
also identified an increase in complex, hybrid network and application-layer attacks. 
Source: http://www.csoonline.com/article/2902309/network-securitv/ddos-attacks-less- 
frequent-last-year-more-dangerous.html#tk.rss news 

23. March 26, Securityweek - (International) Thousands of hijacked WordPress sites 
redirect users to exploit kits. Security researchers at Germany’s Computer Emergency 
Response Team (CERT-Bund) discovered that at least 3,000 Web sites have been 
compromised by a local file inclusion (FFI) vulnerability in the Slider Revolution 
WordPress plugin that allows attackers to take control of sites by accessing and 
downloading files from the affected server. Many victims are directed to exploit kit 
landing pages including Angler and Fiesta which can inject various ransomware, fraud 
malware, and trojan malware into affected systems. 

Source: http://www.securitvweek.com/thousands-hiiacked-wordpress-sites- 
redirect-users-exploit-kits 

For additional stories, see items 6 and 26 
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Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

24. March 27, Natchez Democrat - (Mississippi) Cut fiber optic line disables local Cable 
One Internet. A Cable ONE fiber optic cable was cut by Media 3 crews that were 
attempting to run their own cable March 26, causing service outages for 100 percent of 
Internet and phone customers and approximately 15 percent of cable customers in the 
Natchez area. Service was expected to be restored more than 6 hours after the line was 
severed. 

Source: http://www.natchezdemocrat.com/2015/Q3/27/cut-fiber-optic-line-disables- 
local-cable-one-internet/ 
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Commercial Facilities Sector 

25. March 27, Reuters - (New York) Police seek two people reportedly missing after 
New York explosion. An apparent gas explosion March 26 caused 2 apartment 
buildings to collapse and 2 adjacent apartment buildings to catch fire in the Manhattan 
area of New York City, displacing residents from about 49 units. Nineteen individuals 
were injured during the blast and 2 others were reportedly missing, while firefighters 
remained at the scene March 27 to search the rubble and extinguish smoldering debris. 
Source: http://www.reuters.com/article/2015/03/27/us-usa-new-vork-collapse-missing- 
idUSKBN0MNlOQ20150327 

26. March 26, SC Magazine - (International) Vulnerability found in popular hotel 
routers. Cylance researchers discovered an authentication flaw in the firmware of 
several models of InnGate routers that are commonly used by hotels and convention 
centers that can be exploited to distribute malware to guests, monitor and record data 
sent over the network, and possibly gain access to a hotel’s reservation and keycard 
system. The vulnerability was detected in 277 devices in 29 countries, including more 
than 100 devices located in the U.S. 

Source: http://www.scrnagazine.com/vulnerability-discovered-in-inngate- 
routers/article/405708/ 

27. March 26, Reuters - (Arkansas; Oklahoma) More than 15,000 buildings without 
power after Oklahoma tornadoes. The governor of Oklahoma declared a state of 
emergency in 25 counties March 26 after tornadoes moved across the State and 
Arkansas, March 25 causing widespread damage to several businesses. More than 



-8 - 



15,000 businesses and homes remained without power March 26, and schools were 
closed while cleanup efforts were underway. 

Source: http://www.reuters.com/article/2015/Q3/26/us-usa-torando- 
idUSKBN0MMlRL201 50326 

28. March 26, New Rochelle Daily Voice - (New York) Manhole explosion shakes 
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downtown New Rochelle. Residents from two New Rochelle apartment buildings were 
evacuated for several hours March 26 due to elevated carbon-monoxide readings after 
Con Edison equipment caught and caused a series of manhole explosions. Crews 
remained at the scene to make repairs after fire crews cleared the scene. 

Source: httD://newrochelle. dailvvoice.com/news/manhole-exDlosion-shakes-downtown- 
new-rochelle 



Dams Sector 

Nothing to report 
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-9 - 




NTAS 

A^viwfT 

NO ACTIVE ALERTS 
www.DHS.gov/alerts 



Department of Homeland Security (DHS) 
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About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support @ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US -CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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